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1 • I NXfiQDUgjIC  N_  AJfP_5  YSTE  M_C  V V I J H 


The  ARPA  computer  network  (Ref.  15)  has  been  operational  for  over 
six  years.  During  this  time,  there  have  been  extensive 
aeasureaents  on  the  perfcraance  of  the  coaaunications  subnetwork, 
particularly  by  the  Network  Measurement  Centre  at  the  University 
of  California  (UCLA,  e.g.  Refs.  8 and  10)  and  Bolt,  Beranek  anl 
Newman  (BBN;  e.g.  ,ief.  2).  There  have  been  extensive 
aeasureaents  of  usaqe  of  specific  hosts,  for  example  by  the 
National  Bureau  of  Standards  (NBS ; Ref. 26)  There  have  also  been 
certain  aeasureaents  of  the  network  usage  Bade  for  certain  large 
applications  to  justify  the  cost  of  running  the  network.  There 
have  not,  however,  been  any  consistent  aeasureaents  of  network 
usage  via  one  site.  There  are  several  reasons  for  this  oaission. 
Partly  it  is  due  to  there  being  no  aechanisa  by  which  US  users  cf 
ARPANET  could  be  forced  tc  keep  statistics  of  their  usage,  and 
partly  it  is  due  to  there  being  no  autoaatic  accounting  system 
for  the  use  of  the  network. 

An  atteapt  was  Bade  in  late  1974  by  PBN  to  introduce  an  autoaatic 
accounting  systea  into  the  subnetwork.  The  aechanisa  was  that 
°ach  coaaunicat ion  computer  would  connect  to  a specific  Access 
Control  Host  tefore  it  peraitted  a connection  to  be  opened  to  anv 
other  Host.  Purther  connections  were  peraitted  only  if  the 
correct  user/password  coabinaticn  was  qiven;  after  each  session 
over  a virtual  circuit,  the  accounting  Host  was  inforaed  of  the 
lenqth  of  the  connection  and  the  nuirber  of  packets  transferred 
(unless  the  Access  Control  computer  was  not  available,  in  which 
case  the  statistics  w°te  stored  for  later  transmission).  This 
mechanism  was  abandoned  after  a few  weeks  fcr  several  reasons; 
aaongst  these  were  the  difficulty  cf  maintaining  tne  password 
file  on  the  Access  Control  Host  and  the  sluggishness  ti 
response  of  the  access  control  mechanist. 

At  about  the  same  time  we,  at  the  University  College  London  ( Cl  C I ) 
node  of  ARPANET,  became  interested  in  providing  access  conttcl 
and  accounting.  There  were  twc  reasons  for  this.  Many  bodies 
wished  to  analyze  the  extent  and  value  of  usage  cf  the  ARPANFT 
link  via  the  UCL  node;  they  also  wished  to  be  able  tc  control  the 
access  - particularly  via  the  Public  Switched  Telephone  network 
(PSTN).  Because  we  were  a node  like  any  other,  it  was  not 
possible  to  put  any  special  code  into  the  Hcneywell  116  Teitfinal 
Interface  ler.saqe  Processor  (TTP,  Ref.  13)  which  acts  as  the 
communication  processor  to  the  UCL  site.  Instead,  any  such  code 
had  to  be  provided  outside  the  subnetwork.  However,  since  all 
♦■he  use  of  the  UCL  node  is  purely  experimental,  we  were  entitled 
to  enforce  any  extra  login  procedures  we  wished  ontc  our  users. 
In  addition  to  previdinq  such  access  control  mechanisms,  we  also 
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provided  a nuibfr  cf  neasutenent  facilities  and  it  is  with  tcth 
the  access  control  and  measurements  with  which  this  report  is 
concerned;  we  also  describe  the  network  access  function  we  have 
provided.  Because  the  same  system  provides  both  measurement  and 
access  control,  it  is  the  use  beinq  made  of  the  UCL  node  cf 
ARPANET  over  switched  telephone  lines  or  through  one  of  the  two 
PCP-9s  described  in  the  next  paragraph. 

Two  PDP-9  and  one  PDP-11/3S  computers  are  connected  to  a TIP 
sited  at  UCL.  One  (PDP-9A)  acts  as  a gateway  between  various 
computer  networks,  in  particular,  between  ARPANET  and  the 
Rutherford  Laboratory  ( R L ) star  network  based  on  an  IBM  3&C/195 
(Rof.  16).  On  this,  we  are  able  to  monitor  access  to  these 
machines.  The  second  (PDP-9  E)  is  used  toth  as  a development 
machine  and  for  mcnitcrinq  and  access  control  of  the  dial-up 
lines  of  the  Lcndon-TIP.  It  also  provides  a simple  form  of 
access  to  the  National  Library  of  Medicine  (NLM)  Medline  system. 
The  PDP-11  is  used  as  a qateway  to  a broadcast  satellite  network. 
Our  current  configuration  is  shewn  in  Fig.  1. 

This  report  is  intended  to  be  a definitive  quide  to  a major  part 
of  the  measurement  and  access  control  project  at  UCL  (see  Sec. 
2).  Part  II  describes  the  methods  used  in  detail  and  presents 
sample  results  and  examples  of  the  data.  Pact  m is  a 
comprehensive  summary  of  the  results  which  have  so  far  been 
obtained  (over  a period  cf  about  a year)  and  Part  IV  is  a user's 
guide  to  the  various  programs  developed  for  the  project. 
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Figure  1:  Current  INDRA  Configuration 
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Many  research  groups  in  the  UK  access  various  Hosts  ot  ARPANET 
through  the  Lcndcn-TIP  for  a variety  of  purposes.  The  ais  of 
this  project  is  to  iieasure  that  usage.  This  Measurement  is 
carried  out  at  a number  of  levels,  from  the  user  level  down  to 
the  line  level.  In  many  cases,  the  user  level  measurement 
consists  solely  cf  measuring  the  time  connected  tc  a particular 
Host,  but  in  the  case  of  access  to  one  machine,  the  National 
Library  of  fledicine  (NLM)  IBM  370/15R,  much  more  detailed 
measurement  is  performed.  At  the  line  level,  other  measurements 
are  made  which  are  described  in  another  report  (Ref.  26). 

In  addition  to  measurement,  the  system  provides  an  extremely 
powerful  method  of  access  controL  (Ref.  IB)  with  no  changes  in 
the  TIP  software.  Furthermore,  part  of  the  system  acts  as  a 
Network  Access  Machine  (NAM)  providing  a convenient  method  cf 
accessing  NLN. 

Thus  the  aims  of  the  project  are  four-fold: 

(i)  To  investigate  overheads  in  ARPANET 

(ii)  To  measure  usage  of  the  network 

(iii)  To  provide  access  control  mechanisms 

(iv)  To  provide  a Network  A ccess  Machine 

Only  the  last  three  are  described  in  this  report.  Current  UCl 
work  is  concerned  also  with  measurements  cn  other  ccacuter 
networks,  including  the  UK  Experimental  Packet  Switched  Service 
(EPSS)  and  the  ARFA  sponsored  SATNET  Packet  Satellite  Network 
(Ref.  10).  Yet  ether  measurements  are  concerned  with  the 
response  of  the  UCL  Gateways  under  various  conditions.  Most  of 
this  report  treats  only  measurements  to  determine  the  levels  cf 
usage  by  various  qrcups  cf  resources  cn  ARPANET.  There  are  more 
letailed  measurements  on  the  characteristics  of  various 
dialogues.  Here  only  the  method  and  some  sample  results  are 
given  with  detailed  results  following  in  a later  report  (Ref. 
23). 
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NedsucPient  has  been  carried  out  at  other  ARPANET  sites  and  it 
was  not  the  purpose  cf  this  project  to  duplicate  such  work  but 
rather  to  complement  it.  Two  sites  deeply  ccncerned  with 
monitoring  are  the  National  Bureau  ct  Standards  (NBS)  and  the 
University  of  California  at  Los  Angeles  (UCLA)  Network 
Measurement  Center  (NMC) . In  this  section,  we  mention  the  work 
which  has  been  carried  out  at  those  sites,  to  point  cut  the 
differences  from  cur  approach. 


1.1  National  Bureau  of  Standards 

There  are  two  projects  at  NBS  which  are  relevant  to  our  work. 
The  first  is  that  cn  the  Network  Measurement  System,  the  second 
on  the  Network  Access  Machine  (NAM).  The  Network  Measurement 
System  consists  cf  two  parts.  The  first  is  the  Network 
Measurement  Machine  (NMM)  which  is  (Ref.  27)  "a  device  used  to 
acquire  data  for  the  performance  measurement  of  computer  network 
systems  and  services".  It  consists  of  a DEC  PDF-1  1/20  with  some 
special  purpose  nardware  and  software.  This  machine  performs  the 
actual  data  capture  and  stores  the  data  on  maqnetic  tape  for 
later  processing  by  the  Data  Analysis  Programs  (DAP). 

The  data  collection  is  performed  in  such  a way  as  to  copy  the 
data  with  no  interference  (e.g.  a "T-connect ion").  The  data  is 
recorded  on  maqnetic  tape  with  each  character  being  tiraestamped; 
in  addition,  the  source  of  the  character  is  recorded.  Since 
these  data  are  recorded  in  time  crder,  the  many  conversations 
beinq  monitored  by  the  NMM  are  multiplexed  together  and  hence  th' 
pre-processinq  consists  of  a routine  (RAW)  whicn  performs 
necessary  demultiplexing.  The  resultant  ccnversa t ions  are  then 
(if  occurring  in  full-duplex  mode)  transformed  to  the  equivalent 
half-duplex  conversation.  Non-printinq  characters  are 

transformed  into  a printable  form  (e.g.  carriage  return  is 
printed  as  <CR>)  . The  resultant  files  are  then  analyzed  in 

detail  qivinq  histegrams,  frequency  distributions  etc.  In 
particular,  the  OMNITAB  package  (Ref.  '4)  is  used  to  perform  many 
statistical  functions. 

Besides  the  otvious  relevance  of  the  NMM  to  the  work  at  UCL  (and, 
as  will  be  shown  below,  the  similarity  cf  technique),  the  work  is 
of  interest  since  one  of  the  systems  measured  by  the  NMM  is  the 
MEDLINE  system  at  NLH. 
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1 . 2 Univf rsity_of_Cali torn ia_at_Lcs_ Angeles 

Perhaps  one  of  the  ircst  important  functions  performed  on  the 
ARPANET  is  that  of  the  Network  Measurement  Centre.  This  has 
performed  measurements  cn  the  APPA  sub-network  since  its 
inception.  These  measurements  are  specifically  at  the  sub- 
network level  and  therefore  not  directly  related  tc  the  results 
presented  in  this  Report,  although  they  are  of  relevance  to  the 
sub-network  measurements  cf  Treadwell  (Ref.  26). 

In  addition  to  performing  simple  measurements,  the  NMC  also  has 
facilities  for  performing  specific  experiments  (in  conjunction 
with  the  Network  Ccntrol  Center)  and  thes^  are  carried  out  at 
frequent  intervals.  The  results  of  such  experiments  enable 
incipient  faults  tc  be  detected,  allow  evaluation  of  the  various 
low-level  protocols,  give  breakdowns  of  network  traffic  in  terms 
of  the  various  overheads  etc. 

An  example  of  the  results  obtained  is  given  in  Ref.  12. 
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1.1  2SS5_ Access. Cc n t ro 1 

T h»  program  which  performs  the  actual  monitorinq  and  access 
control  is  called  CUES.  This  is  one  sequent  ol  a network  system 
which  runs  on  PDP-1R.  When  the  system  is  initialized  and  has 
established  communication  with  the  TIP,  CUES  sets  up  a control 
connection  to  a specific  pert  on  the  TIP;  via  tnis  connection, 
QtJES  attempts  to  connect  to  other  TIP  ports  (which  are  specified 
by  entries  in  a disk  file  which  may  easily  be  Modified) . Each 
pert  nay  be  in  one  of  three  states.  The  first  is  WILD,  in  wnich 
case  thero  is  nc  user  connected;  in  this  state,  gOES  may  (and 
indeed  does)  make  the  connection.  When  a user  dials  in,  this 
connection  is  broken  and,  on  notinq  this,  CUES  remakes  it  and 
interrogates  the  user  ty  asking  for  surnane,  TIP  password  and 
nuiber  of  required  Host  (a  typical  scenario  is  shown  in  Fig.  2). 
To  save  time,  a user  may  qive  ail  three  replies  in  response  to 
the  first  question. 

Tf  the  replies  are  satisfactory,  CUES  then  breaks  the  connection 
and  waits  20  seconds  before  attempting  to  remake  it.  If  the 
replies  are  unsatisfactory,  the  user  is  allowed  a second  attempt 
then,  if  still  incotrect,  he  is  disconnected.  It  would  have  h en 
possible  for  us  to  have  tetter  access  control  by  making  the 
connection  tor  the  user.  This  would  require,  however,  a 
considerably  heavier  epu  load  and  to  reduce  this,  we  only  make 
the  connection  in  the  specific  case  that  we  wish  to  record  the 
whole  dialoque  for  subsequent  analysis  (as  we  do  in  the  case  of 
MEDLINE;  see  below)  . 

tf  the  user  qives  correct  answers  and  succeeds  in  connecting  to 
the  Host  within  the  requisite  time,  QUES  enters  its  third  phase 
in  which  it  attempts  (at  cne  seccnd  intervals)  to  reconnect  to 
t he  por t . 

when  the  user  closes  his  connection  to  the  remote  Host,  QUES  is 
one®  more  atle  tc  ccnnect  tc  him  and  requests  the  number  of  the 
next  Host  required  (name  and  password  are  net  requested  again). 
This  procedure  is  then  repeated  continuously. 


INDHA  TR-30 


The  INCRA  Network  Measurement  Project 


15  - 


LONDON-T  IF  MONITORING  SERVICE. 


SURNAME  >stckes 

TIP  PASSWORD  >xix 

PASSWORD  UNKNOWN  - REENTER  >ucl 


HOST  NtJMEEB  >42 
OK  - EYE 
Cl  ose  1 

«L  42 


iC 

Open 

NEXT  HOST  NUMEER  CR  PING 


* message  from  the  TIF 

* user  legs  in  to  host 

* close  connection  to  host 

* messaqe  from  TIP 
OFF  NOVI  > 


Fiqure  2:  A Typical  C'JES  Scenario 


All  the  data  supplied  by  the  user  are  printed  by  QV*  onto  a 
paper  tape  (thus  obviating  problems  such  as  closing  files  after  a 
system  crash);  similarly,  when  the  user  disconnects  from  his 
Host,  his  connect  time  is  recorded  on  the  tape. 

In  the  unlikely  event  that  the  system  does  crash,  it  is 
convenient  to  knew  the  time,  and  this  may  prove  iifficult  at 
night  when  there  is  little  activity.  Por  this  reason,  g'lF.j 
prints  a message  tc  indicate  that  it  is  still  running  every  half- 
heur . 

A sample  of  the  output  frem  the  program  is  shown  in  Appendix  1. 


1.2  MEDLINE. Access 

The  only  exception  to  the  above  procedure  is  in  the  special  cise 
where  the  Host  the  user  wishes  to  access  is  the  National  Library 
of  Medicine  (NLM).  The  British  library,  as  part  of  its  Short 
Term  Experimental  Information  Network  Prelect  (Ref.  5)  has  i 
number  of  centres  which  access  the  MEDLINE  system  on  the  MM  ISM 
170/15R.  This  machine  is  not  connected  to  ARPANET  as  a 
conventional  Host,  tut  rather  simulates  five  interactive 
terminals  on  the  National  Bureau  of  Standards  (NES)  TIP. 
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Since  this  Bakes  the  process  of  connection  extremely  inconvenient 
and  also  provides  little  status  information,  we  have  written  a 
program  which  alsc  runs  under  our  network  software  on  the  ECP-9 
and  which  automates  the  connection  procedure.  If  a user 
specifies  that  he  wishes  to  access  the  HEDLINE  systea  (by  giving 
the  NBS-TIP  number  or  MPDLINE  when  asked  for  Hcst  number),  he  is 
automatically  routed  to  this  program.  The  data  path  for  this 
mode  of  access  is  shewn  in  Pig.  3. 

The  proqram  attempts  to  make  a connection  to  each  of  the  NLN 
ports  in  turn;  there  are  two  ports  (134,  136)  at  10  characters  a 
second  and  three  (140,142  and  144)  at  30  cps.  If  the  user 
specifies  that  he  has  a fast  terminal,  the  scan  starts  at  port 
134.  An  attempt  is  made  to  connect  tc  each  port.  This  attempt 
may  be  successful,  in  which  case  the  user  is  connected  tc  the 
port;  it  may  be  unsuccessful,  in  which  case  the  next  port  is 
tried;  or  it  may  te  partially  successful.  Per  example,  the 
connection  to  NLH  may  be  opened  tut  the  messaqes  from  NLH  may  not 
be  those  expected  (if,  say,  a user  had  disconnected  in  the  middle 
of  a search)  and  the  proqram  attempts  to  correct  this  state,  then 
connect,  the  user. 

Once  the  aessaqe 


PLEASE  ENTFR  USFPIE 

is  received,  the  user  is  asked  for  his  NL*  ID.  This  is  usually 
one  in  the  ranqe  NLLC2  to  NLL06  and  the  user  does  not  care  which 
is  used.  In  this  case,  he  *ypes  a carriaqc  return  and  the 
proqram  chooses  one  which  it  believes  is  net  in  use.  If  it  is 
(signified  by  the  appropriate  message  from  NLN)  , the  program 
notes  this  (for  subsequent  users)  and  chooses  another  until  the 
user  is  connected.  The  program  then  prints  a message  to  the  user 
indicating  the  pert  and  userid  (in  case  the  system  crashes  and 
the  user  has  tc  reconnect  manually).  From  this  stage  on,  the 
program  maintains  a virtually  transparent  connection  tc  N I M ; seme 
NLfl  system  messaaes  are  modified  for  brevity  and  convenience 
(e.q.  the  PROG:  prompt  is  removed  entirely).  In  addition,  the 
program  is  able  tc  monitor  the  entire  conversation  if  reguired 
(see  the  next  Section). 

If  the  UCL  program  is  unable  to  make  the  connection  (cr  if  the 
user  states  that  he  dc«s  net  wish  to  use  the  program  ty 
specifying  the  Host  as  NLH)  , v^HFS  allows  the  user  two  minutes 
rather  than  the  standard  twenty  seconds  to  make  the  connection 
since  the  procedure  is  considerably  more  complicated  in  this 
case. 
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1 . 3 DLI  NE_  Heasu r e *en  t 

The  proqraa  described  in  the  previous  section  has  an  option  which 
enables  it  to  monitor  all  interactions.  The  use  of  the  UCL  node 
is  recognised  as  purely  experimental . Ail  users  of  the  UCL  TIP 
via  the  switched  telephone  network  have  to  agree  to  the 
conditions  of  such  usage;  these  conditions  include  that  their 
interactions  may  te  recorded  and  analyzed.  Tnis  restriction  does 
not  apply  to  usage  of  the  gcL  node  froa  the  US;  in  any  case,  such 
data  cannot  te  captured  by  the  UCL  measurement  system,  except  to 
the  extent  described  in  Section  2.  The  aonitorinq  consists  cf 
copying  all  the  input  and  output  to  or  froa  the  user  and  N L H , 
together  with  the  output  to  the  system  console  and  log,  cntc  an 
industry  compatible  9 track,  800  bpi  magnetic  tape  (or, 
optionally,  onto  the  FDP-9  disk  - this  option  is  convenient  fcr 
test  runs).  Each  record  is  datestaaped  (to  the  nearest  tenth  cf 
a second)  and  has  the  channel  designation,  together  witn  the 
direction  of  the  data,  added.  Thus  a sample  record  might  be: 

03  HAY  76  09  S2  10.1  K<  TERHINAL  (PAST  CR  SLCU) > 

in  which,  at  the  specified  date  and  time,  the  message  "TERHINAL 
(PAST  OR  SL08)  >"  was  sent  to  channel  K (which  happens  to  be  a 
user  on  TIP  pert  70).  The  system  console  and  the  system  leg  are 
represented  by  the  characters  I and  * respectively.  A sample  of 
the  lata  recorded  on  tape  is  shown  in  Appendix  1. 

Two  other  items  are  noticeable  in  this  data.  The  first  is  that 
the  lata  from  all  the  channels  is  multiplexed  together  and  hence 
must  demultiplexed  before  it  can  be  analyzed  (see  Sec.  1)  . 
Secondly,  some  messages  ate  sent  with  no  terminating  carriage 
return/line  feed  and  hence  these  characters  aie  appended  to  each 
such  line,  together  with  a special  character  (!)  to  dencto  that 
this  has  been  dene. 

The  data  is  recorded  cn  the  tape  with  cne  file  corresponding  tc 
one  session  (where  a session  is  terminated  either,  by  the  operator 
or  by  a system  crash).  The  tape  is  then  sent  to  the  R I.  360/1SS 
for  analysis  as  described  in  Sec.  3. 


I NOR  A TR-19 


The  INDRA  Network  Measurement  Project 


19  - 


2 . GAJEIU  Y_HON  IlCRIJG 

ThP  previous  section  has  described  the  use  made  ct  PDP-9R.  This 
section  describes  measurements  recorded  on  PDP-9A.  This  machine 
is  attached  as  a local  lost  tc  the  TIP  and  acts  as  a gateway 
between  ARPANET  and  various  other  computers.  In  particular,  at 
the  present  time,  it  is  connected  to  the  RL  360/195  (which  is  the 
central  node  of  a star  network,  the  ether  nodes  being,  in  the 
main,  G EC  2050  computers  simulating  IPfl  1130s)  and  the  Royal 
Signals  and  Radar  Establishment  (R5RE)  GEC  4080.  Previously,  it 
was  connected  to  the  Cambridge  Computer  Aided  Cesiqn  Centre 
(CADC)  Atlas  computer. 

The  RL  360/195  is  cne  of  the  largest  computers  on  ARPANET  and 
hence  its  use  fcom  the  network  is  cf  considerable  interest.  This 
use  has  been  restricted  to  specific  collaboration  between 
research  groups  in  the  ns  and  RL,  together  with  local  use  by  DC I 
staff  who  access  the  360  through  the  TIP.  There  has  been  a small 
amount  of  other  usage.  Thus  the  usage  is,  in  a sense,  the 
inverse  to  that  measured  by  OURS  described  above,  although  usage 
directly  corresponding  to  QUES  is  provided  by  RL  users  accessing 
ARPANET  through  tie  PDP-9.  The  RSRE  4080  is  used  by  research 
qroups  in  the  US  accessing  the  CORAL  compiler,  mainly  fet 
evaluation  purposes. 

The  data  recorded  by  PDP-9A  is  also  on  a paper  tape  tor  the 
reasons  outlined  in  the  previous  section.  This  tape  is  a direct 
transcript  of  the  system  log  and  records  such  information  as  the 
remote  computers  (and,  of  course,  the  IMP)  being  up  or  down,  the 
use  by  various  people  (the  Hcst  trem  which  access  was  made,  the 
identifier  use)  and  the  initials  of  the  person)  and,  since  these 
data  are  timestamped  (only  tc  the  nearest  minute),  the  'imr 
connected  to  the  various  machines.  In  addition,  any  batch  -jot., 
(including  those  arisinq  from  file  transfers)  are  also  recorded. 
Sample  data  are  sbewr  in  Appendix  1. 
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3.  ANALYSIS.PROGRAMS 


The  analysis  programs  fcr  the  user  level  analyses  on  the  RL 
360/195  are  combined  into  one  module  called  XPST ATS . *11  the 
programs  are  written  in  Babbage  (Refs.  15  and  25)  and  Bake  heavy 
use  of  its  system  litrary  (Ref.  19). 

The  module  consists  cf  a central  driver  routine,  toqether  with  a 
number  of  independent  segments  wich  perform  various  analysis 
functions.  The  largest  one,  \jnES,  analyzes  the  data  produced  ty 
the  POP-9  QUE3  program  and  produces  various  matrices,  histograms 
etc. 


3. 1 QZf ryiew_o f_ihe_ XFSJiTS_£ackage 

XFSTATS  takes  three  inputs.  The  first  is  the  tables;  these 
specify  the  fault  captions,  the  allowed  control  cards,  the  loqal 
TIP  passwords,  the  nates  cf  the  computecs/networks  connected  to 
PDP-9A  and  the  list  of  360  IDs  used  ty  separate  projects.  The 
second  is  the  data;  this  is  effectively  a concatenation  cf  all 
possible  inputs.  The  last  is  the  control  file;  this  consists  cf 
a sequence  of  lines,  each  specifying  an  option.  The  order  of 
these  lines  is  net  significant  since  they  are  net  interpret  i in 
order  of  readinq  tut  rather  the  entire  file  is  read  by  a parsing 
proqrara  (Ref.  19)  which  constructs  an  appropriate  data  structure 
which  is  handed  tc  XFSTATS.  An  example  of  a control  file  is: 

QOES 

FROM  1/6/75 
TO  1 July  75 
CONNECT  TIHFS 
HISTOGRAM  CF  PORT  USAGE 
T I PIES  CP  MONITORING 
END 

It  can  be  seen  that  a very  flexible  input  format  is  aliewed. 
Pach  coBiand  Bay  te  abbreviated  to  four  characters  if  required. 

XPSTAT3  determines  the  type  of  analysis  to  be  performed  from  the 
control  cards  and,  where  relevant,  limits  such  as  start  and  enl 
dates  (which  default  to  1 July  75  and  1 July  76  respectively). 
Tt  then  reads  the  data  file,  iqnoring  any  data  not  within  the 
specified  liaits  and  performs  the  appropriate  analyses. 
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3.2  f^cili t ies_P£cvi ded 

The  XPSTATS  program  allows  many  analysis  functions  to  be 
performed.  In  this  section,  we  describe  the  facilities 
available.  A similar  description,  but  written  from  the  point  of 
view  of  the  user,  is  qiven  in  Ref.  20. 


(a)  flOES 

This  is  the  maqor  PDP-^K  analysis  program.  It  produces 
measurement  data  fcr  the  output  from  QUES.  It  operates  by 
buildinq  a data  structure  in  core  for  the  compressed  data  (see 
below)  and  then,  depending  on  the  control  cards,  prints  certain 
data.  The  functions  available  are: 

Times  mcnitored 

Surnames  used  for  each  ident 

Number  of  lcqins,  connect  time  and  number  of  hosts  used 
for  each  ident 

Number  of  lcqins,  connect  time  and  number  of  users 
for  each  host 

Matrix  of  connect  times  fcr  hcst  number/ident  pairs 

Where  appropriate,  the  data  may  te  requested  in  qraphi  ll  form. 
Examples  of  the  output  are  qiven  in  Appendix  1. 


(b)  LOGB 

This  program  checks  the  input  (the  POP-")  paper  tape  Icq)  fcr 
errors,  removes  superfluous  lines  (e.g.  "Q0E3  CK")  , removes  .if 
where  the  user  has  qiven  an  incorrect  password  or  Hcst  (these  ac- 
printed  out  fcr  inspection,  tut  not  passed  onto  the  analysis 
proqrams)  and  compresses  the  data.  In  particular,  the  connect 
time  is  appended  to  the  message  generated  when  the  user  legs  in. 
Two  problems  arise.  The  first  is  that  monitoring  may  be 
terminated  while  a user  is  still  legged  in;  in  this  case,  the 
OUES  program  prints  cut  the  connect  time  up  to  the  termination 
and  so  the  time  recorded  is  an  underestimate.  This  of  cojisp 

presents  no  protlems  to  LOGB,  since  there  is  no  difference 

between  such  a message  and  a qenuine  log  out.  The  second  rise, 
when  the  system  crashes  while  users  are  loqged  in,  does  present  a 
problem;  in  such  a case,  LOGB  detects  this  by  the  occurrence  cf  a 
'•MONITORING  STARTED"  messaqe  net  preceded  by  a "MCNITCRING 

TERMINATED"  message.  It  generates  the  latter  and  the  associated 

logout  messaqes  at  the  last  time  fcr  which  it  had  a valid  message 
(hence  the  reason  for  the  production  of  the  "COES  CK"  messages). 
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The  proqca  a alsc  produces  lessages  indicating  the  number  of  ports 
in  use.  Due  to  a temporary  restriction  on  the  number  of  channels 
available  in  the  FPP-9,  QUES  only  monitors  sir  ports  at  present. 
Tt  is  a siaple  natter  for  LOGB  to  record  the  number  of  ports  in 
use  ercept  for  one  case,  when  QDES  starts  monitoring.  In  this 
case,  ports  aay  already  be  in  use;  the  version  of  QUFS  to  which 
we  are  referrinq  did  not  attempt  to  distinguish  whether  the  pert 
was  in  use  by  a genuine  user  or  not  (e.q.  scaecne  having  dialled 
the  TIP  number  by  mistake).  This  distinction  can  be  deduced  by 
OWES  with  a reasonable  degree  of  certainty  by  knowing  the  TIP 
timeout  period.  However,  the  timeout  period  is  not  guaranteed  tc 
remain  constant  and  the  method  is  net  completely  reliable.  In 
the  data  we  present  here,  this  was  not  dene  and  LCGE  had  to 
deduce  the  number  of  ports  in  use.  Due  to  the  mode  of  operation 
of  the  telephone  system,  a user  is  allocated  to  the  lowest, 
numbered  free  port  on  dialling  up.  At  present,  we  monitor  ports 
70  to  7 S (octal).  If  the  first  port  to  be  used  after  COE'S  was 
initialized  was  71,  LOGB  would  assume  that  port  70  was  in  use  at 
that  tim®.  LOGB  takes  steps  to  ensure  that  such  an  error  is  net 
propaqated  if  the  pert  was  net  in  genuine  use. 

Thus  LOGB  produces  an  output  file,  an  example  of  which  is  given 
in  Appendix  1.2  (the  output  is  that  produced  with  the  data  in 
Appendix  1.1  as  input).  This  file  is  in  a standard  format  and 
may  be  assumed  to  be  error  free  and  it  may  be  analyzed  by  QUES. 


(c)  I DENT- an d_ HOST 

These  two  programs  perform  very  similar  functions  and  simply  edit 
the  data,  only  printing  interactions  which  appertain  either  tc  a 
specific  ident  (TIP  password)  or  host  number.  Strictly,  they 
should  not  be  included  in  this  document  since  they  perform  no 
analysis  functions,  but  it  is  often  convenient  to  examine  the 
data  visually  and  these  programs  facilitate  this.  In  addition, 
they  print  appropriate  histograms  if  required;  in  the  case  of 
IDENT,  the  histograms  are  those  of  time  and  users,  in  the  case  of 
HOST,  only  the  former. 


( d)  ?QRI_I2SiGE_£lATISIlC2 

This  proqram  operates  on  the  compressed  data  from  either  PDP-g. 
Tt  produces  statistics  on  port.  usage,  in  tabular  form  and 
graphically.  The  statistics  produced  are  the  time  monitored,  the 
number  of  logins,  the  amount  of  time  used  and,  from  these,  the 
average  time  per  login  and  the  percentage  TIP  port  utilization, 
the  statistics  may  te  produced  over  any  specified  dates  and  t.hev 
ate  broken  down  by  hour  of  day  or  weekend.  In  addition,  a table 
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is  produced  indicating  the  number  of  ports  in  use  whenever  there 
is  a new  login.  If  used  cn  the  PDP-9A  log,  the  program  only 
examines  the  port  utilization  for  one  computer  (PDP-9A,  RL  360  cr 
RSRE  U090)  and  the  required  one  must  be  specified  as  an 
additional  parameter. 


{ e)  MEDPRINJ 

Althouqh  the  raa-jor  MEDLINE  measurement  is  from  the  output  on 
magnetic  tape,  some  data  is  produced  on  the  PDP-9B  log  and  it  is 
this  which  is  analyzed  by  MEDPRINT.  Fcr  each  interaction,  the 
program  calculates  the  time  per  line  from  NLM  and  the  user,  the 
average  number  of  characters  pet  line  each  way  and  th°  ratio  of 
number  of  lines  from  NLM  to  number  of  lines  from  the  user.  At 
the  end,  a summary  of  the  results,  including  the  mean  and 
standard  deviation  of  each  value  is  printed. 


( f ) DEMUX 

As  described  in  Sec.  1.3,  the  various  interactions  monitored  by 
MEDLINE  are  multiplexed  together  onto  magnetic  tape.  Tt  is  the 
purpose  of  DEMUX  tc  demultiplex  them  into  the  separate 
conversations.  The  output  is  then  identical  to  that  urinted  at 
the  user's  terminal  with  the  addition  of  a datestarap  to  each 
complete  line  (N.E.  if  the  user  replied  to  a question  on  the  same 
line  as  the  question,  his  reply  is  net  datestamped)  . In 
adlition,  various  data  about  the  interaction  which  are  extracted 
from  the  loq  stream  (such  as  the  user's  name  and  password  and  the 
number  of  lines  and  characters  to  and  from  the  terminal'  ai 
added . 

DEMUX  may  be  used  to  analyze  entire  files  (where  a tile,  in 
general,  corresponds  to  one  measurement  session)  or  to  extract 
specific  interactions  flora  the  file.  This  latter  facility  is  of 
considerable  use  since  MEDLINE  monitors  ALL  interactions  and  t ho 
lata  on  the  channels  connected  tc  NLM  ar°  very  similar  (altnouqh 
net.  identical  - see  Sec.  1.3)  to  those  to  the  u"er. 


(9)  3EDLINE 

This  is  the  program  which  performs  the  actual  analysis  of  the 
user  conversat ions  with  NLM.  Once  again,  many  options  arc 
available  and  the  user  of  the  analysis  package  may  choose  which 
are  required. 

The  program  takes  an  individual  interaction  ar.d  perform  various 
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a na  1 y ses  on  it.  The  available  data  are  as  fellows: 

Nu» be r of  characters  to  and  froa  NLT 
Number  of  characters  tc  and  from  the  user 
Occurrence  of  NLP1  system  keywords 
Number  of  searches  in  the  session 
Number  of  tens  per  search 
Number  of  sub-terms  per  search  statement 


( h)  LOGA 

The  output  froa  the  PDP-9A  is  a direct  transcript  of  the  console 
log  and,  as  such,  contains  aessages  froa  various  places  such  as 
the  supervisor,  as  well  as  the  neasureaent  messages  in  which  we 
are  interested.  In  addition,  the  date  and/or  tiae  are  suppressed 
in  some  cases  (only  if  they  are  identical  tc  the  last  date  or 
tiae  printed).  Since  the  foraat  is  not  that  expected  by  XFSTATS, 
this  is  cleaned  up  by  a stand-alone  program  called  TIDYA.  This 
r oaove.i  all  blank  lines  and  lines  consisting  solely  of  a system 
proapt  character  (>) . It  then  removes  all  lines  which  do  net 
conform  to  the  expected  feraat  and  prints  them  out  on  a log 
stream  for  inspection.  The  remainder  then  have  the  date  and/cr 
time  added  where  reguired.  The  output  froa  this  is  similar  to 
that  produced  by  FDP-9B  and  is  processed  by  a program  called 
r.CGA. 


This  operates  in  a very  similar  manner  to  that  of  LCGB  iescribed 
in  (a)  above  and  generates  an  output  of  a similar,  compressed, 
format  (see  App.  1.8).  However,  it  is  considerably  more  complex 
due  to  the  larger  number  of  different  types  of  interaction 
possible  (e. q.  terminal  access  tc  360,  terminal  access  from  36C, 
file  transfers  etc.)  and  the  number  of  connected  computers.  The 
techniques  used  tc  perform  the  compression  are  described  in 
detail  in  Ref.  7 2.  This  output  is  assumed  to  be  error  free  and 
may  be  analyzed  by  the  program  PDP9A  described  in  the  next 
sect  ion . 


(i)  PDP9A 

This  is  the  malor  analysis  pregram  for  the  PPP-bA.  It  acts  in  a 
very  similar  way  to  that,  for  PDP-9B  (QUE.'J,  see  (a)  above).  That 
is,  it  reads  the  compressed  data  file,  generates  a data  structure 
then,  depending  on  the  analyses  requested,  prints  out  suitable 
tatles  and  graphs. 

The  analyses  available  are  as  follows: 
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Times  monitored 

Up  time  of  the  connected  computers 
Number  of  ARPA  Protocol  errors  by  Host 
Number  and  distribution  of  file  transfers 
Initials  used  for  each  ident 

Number  of  loqins  and  connect  time  ter  each  ident 
Number  of  lcqins  and  connect  time  from  each  host 
Matrix  of  connect  times  tor  each  host  number/ident  pair 

If  required,  the  various  idents  may  be  qrcuped  together  by 
prolPCt  and  the  same  data  produced.  In  addition,  the  data  may  te 
ptoduced  either  for  ARPANET  users  accessing  the  RL  160  cr  360 
users  accessinq  ARPANET.  In  all  cases,  histograms  may  te 
requested  where  appropriate. 
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4 . S AHP[.E_RES0LT  S 


4.1  Monitor in^ 

> In  a project  such  as  this  where  a large  amount  of  significant 

data  is  collected,  it  is  not  easy  to  qive  selected  results. 

5 However,  this  has  been  done  and  the  results  are  presented  in  Part 

III.  This  section  is  intended  merely  to  show  the  type  of  output 
which  the  analysis  routines  are  able  to  produce  and  to  give 
examples  of  other  information  which  may  be  deduced. 

In  all  these  sample  results,  the  month  of  July  1975  is  chosen. 
In  the  full  results  presented  later,  the  year  July  75  to  June  76 
is  used.  Before  July  1975,  although  TIP  password  checking  was 
performed,  illegal  access  was  not  prohibited.  Thus  the  validity 
of  any  results  befcre  this  date  is  questionable. 

A single  month  provides  a reasonable  volume  of  data  covering 
various  times  of  day.  July  1975  was  chosen  specifically  since  it 
was  the  month  in  which  we  did  most  monitoring;  PDP-9B  is  also 
used  for  system  development  and  monitoring  is  only  performed  when 
it  is  not  used  for  that  purpose.  Thus  the  amount  of  monitoring 
varies  considerably  from  week  to  week  and  much  of  the  monitoring 
is  at  night  and  weekends  with  few  users;  at  such  times,  the  rain 
value  of  the  system  is  for  controlling  improper  access.  Iri  the 
month  concerned,  we  monitored  the  TIP  for  525  hours  (701)  broken 
down  in  the  following  way: 

0000-9800  0800-1300  1300-1800  1800-2400  Weekends 


Total  (mi 

l ns) 

912C 

5571 

1713 

4426 

10674 

flins/day  (av) 
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74 
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1334 

X of  ti 

l me 

82.7 

30.7 

24.8 

53.5 

92.7 
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will  concern 
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global 
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general 
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ic  user 

(iii)  The  pattern  of  usage  cf  cne  specific  host 
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On  the  qlobal  picture,  we  monitored  the  TIF  for  .1  1,504  minutes 
(70%)  in  the  tenth.  The  total  time  users  were  connected  tc 
various  Hosts  was  10,761  user  minutes,  giving  a usage  of  the  six 
ports  aonitored  of  5.71  However,  auch  of  the  tiae  aonitcred  was 
at  weekends  and  night  and  the  breakdown  of  this  figure  over  the 


time  periods  used  above 

is : 

00  00 -OR  CO 

0800-1300 

1 300- 1800 

1R00-2400 

heekends 

Time*ports  94 

R0  39 

1443 

462 

723 

% ports  used  0.2 

24.  1 

14.0 

1.7 

1.  1 

Logins  2 

435 

62 

42 

44 

(where  the  percentage  referred  to  is  the  percentage  Fcrt 
utilization).  The  high  figure  in  the  0800-1300  tiae  is  due  to 
the  non-a va i la bi 1 i t y of  aany  us  hosts  to  us  in  their  prise  shift 
(1300  onwards,  OK  tiae).  This  restriction  applies  to  the  two 
Hosts  that  were  used  most  heavily,  NLM  and  the  Information 
Sciences  Institute  (ISI)  PDP-10X.  A general  matrix  is  produced 

of  the  usage  at  each  Host  ty  each  user  grcup.  The  complete 

matrix  in  our  case  would  be  quite  unreadable.  A partial  matrix 
is  shown  in  Appendix  1.5.  The  twc  nest  heavily  used  Hosts  during 

this  period  were  Host  147  (71%)  and  ISI  (13%).  The  re.  sen  that 

the  former  was  used  so  heavily  was  that  it  had  been  unavailable 
for  most  of  June;  in  addition,  the  general  university  usage  was 
lew  in  July  because  of  the  onset,  of  holidays. 

The  pattern  of  usage  overall  is  much  as  expected  and  is  shewn  in 
Pig.  4.  In  this,  attempts  tc  connect  to  a Host  whi>'h  "• 

available  are  excluded  (Q0ES  records  this  as  a connect  t^„.  • 
zero;  there  were  115  such  occurrences  in  July).  The  secern  ; 
histogram  shows  the  zero  to  ten  minutes  segment  on  a larger 
scale;  the  zero  tc  thirty  seconds  time  period  contains  many  users 
who,  although  connected  tc  the  Hcst,  were  unable  to  log-in  either 
due  to  the  Rost  refusing  to  allow  the  log-in  or  regectirg  it  due 
tc  illegal  account  parameters. 

It  is  of  considerable  interest  to  determine  the  number  of 

connections  made  and  ports  occupied  and  these  are  test  normalized 
with  respect  to  the  average  number  of  torts  in  use.  Typical 
results  of  the  ports  in  use  over  particular  periods  are  shown  in 
Pig.  5.  K?  also  have  histogram  information  on  the  number  of 
ports  in  use  at  any  one  time.  This  information  can  be  used  tc 

guide  the  TIP  owner  cn  the  number  of  dial-up  ports  li»  should 

provide. 

The  second  aspect  which  we  wish  tc  examine  is  tne  pattern  cf  one 
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Figure  5:  TIP  Port  Usage  (July  1975)  As  A Function  Of  Time  Of  Day 
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Figure  6:  Pattern  of  Usage  for  A Specific  User 
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specific  user  (Feter  Kirstein) . His  usage  this  month  was 
confined  ‘Exclusively  to  one  Host,  ISI,  and  there  were  three  types 
of  usage;  these  are  clearly  reflected  in  the  connect  times  (Fig. 
6).  The  first  is  usaqe  such  as  reading  mail  or  sending  messages. 
This  takes  a relatively  short  time,  of  the  order  of  ten  oinutes. 
The  second  usage  is  editing  documents  and  this  gives  rise  tc 
connect  tiaes  of  the  order  of  half  an  hour.  The  third  usage  is 
entering  documents  and,  to  a greater  extent,  teleconferencing 
where  connect  tiaes  are  of  the  order  of  hours.  This  pattern, 
which  shows  up  clearly  in  the  histogran  of  Fig.  6 where  there 
were  only  nineteen  logins,  is  even  clearer  over  longer  periods. 

The  last  usage  we  consider  is  that  of  a specific  Host.  As  we 
Mentioned  above,  a number  of  centres  in  Britain  access  the 
MEDLINE  systea  on  the  NLM  IBM  370/158  to  perform  bibliographic 
searches.  In  addition  to  the  QOFS  aonitcring,  we  are  able  tc 
Monitor  other  details  since  each  line  from  the  user  and  from  mm 
passes  through  the  PDP-9.  In  particular,  we  monitor  the  number 
of  characters  and  lines  each  way.  We  also  record  the  nuaber  of 
searches  carried  out,  but  this  depends  on  the  user  specifying 
this  nuaber  accurately  to  NLM;  also,  the  actual  number  is,  to  a 
certain  extent,  sutlective.  Therefore,  we  dc  net  Bake 
significant  use  cf  this  inforaaticn. 

In  the  month  we  are  considering,  we  recorded  148  logins  tc  * rH, 
giving  a total  connect  time  of  7 385  minutes.  Eliminating  t.iose 
logins  where  MEDLINE  was  not  available  (shown  by  a very  short 
connect  time  * of  the  order  of  a few  minutes  - and  the  user 
specifying  that  nc  searches  were  done  and  giving  no  "PRINT" 
commands) , or  where  we  did  not  generate  full  statistics,  we  had 
87  logins. 

Although  the  number  of  observations  is  reasonably  high,  the 
variation  in  the  parameters  was  surprising.  The  greatest 
consistency  was  in  the  time  spent  legged  in,  an  average  of  just 
under  33  minutes  with  a ras  deviation  of  1M  of  this  value.  Two 
parameters  which  aiqht  have  teen  expectel  to  te  fairlv 
consistent,  the  average  nuaber  of  characters  per  line  to  and  frci 
NLM  each  session,  showed  wide  variations  over  the  recorded 
sessions.  The  averages  were  16.64  and  13.65  respectively  with 
rms  deviations  of  311  and  49*  of  those  figures.  Similarly  high 
deviations  were  shown  in  the  ratio  of  the  lines  from  NL.M  tc  lines 
from  the  user  (52*),  the  time  pet  line  from  NLM  (46*)  and  the 
time  per  line  from  the  user  (58*).  These  results  are  tabulated 
in  Pig.  7. 
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Total 

Average 

RMS  Deviation 

Time  loqqed 

i n 

171 

349 

1970 

217 

Characters 

from  NLH 

551 

925 

6344 

5319 

Lines  from 

NLM 

32 

569 

374 

284 

Characters 

from  user 

1C5 

979 

1218 

2088 

Lines  from 

user 

8 

554 

98 

17  1 

Average  time  per  line  from  NLH 

- 

5.7 

2.6 

Time  per  line  from  user 

- 

42 

24 

Characters 

per  line  from  NLM 

- 

17 

5 

Characters 

per  line  from  user 

- 

14 

7 

Lines  from 

NLM/Lines  from  user 

- 

8 

4 

Piqure  7;  Characteristics  cf  NLH  Usage  (tines  in  minutes) 


4 . 2 PDP-7A_Loa_Resuits 

As  in  the  previous  section,  we  present  results  here  tc  illustrate 
the  type  of  data  analysis  possible  and  this  nay  best  be  done  wi 
a relatively  short  period,  namely  a month.  The  month  cf  February 
1976  was  chosen  since  this  is  the  first  month  for  which  we  have 
full  monitoring  since  the  change  of  output  format  to  the  PDP-9 
log  (the  programs  currently  accept  the  new  format  alone,  although 
they  will  be  changed  to  allow  the  previous  format;  the  change  cf 
format  was  simply  tc  reduce  the  amount  cf  data  punched  while 
retaining  all  the  infer maticn)  . 

The  PDP-9  was  up  for  over  93*  of  the  available  time.  It  was 
taken  down  correctly  6 times  and  crashed  (or  was  taken  down 
incorrectly)  53  times,  giving  a mean  time  between  failure  or  over 
12  hours.  The  IMF  (as  usual)  was  exceptionally  reliable,  contact 
beinq  lost  a total  of  15  times  in  the  month,  qiving  a MT8F  of 
nearly  40  hours.  The  RL  and  RSRE  machines  were  noticeably  less 
reliable. 
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The  average  PDP-9  port  usage  (3.311)  is  quite  low,  tut  there  were 
a total  of  226?  logins  in  the  month.  However,  only  on  one 
occasion  were  all  five  Forts  in  use  (for  a total  of  two  minutes). 
There  is  no  record  of  the  number  of  times  a user  was  rejected, 
but  obviously  it  cannot  be  mere  than  the  above  figure  and  hence 
it  is  safe  to  say  that  this  did  not  happen  in  the  month. 

Tne  average  usage  of  the  three  360  ports  (1.111)  was  relatively 
low,  but  since  usage  is  heavily  concentrated  in  peak  hours,  this 
figure  does  not  give  a true  indication  of  the  usage.  Perhaps  a 
better  indication  is  the  fact  that  a user  was  rejected  from  using 
the  160  seven  times  in  the  whole  month,  while  all  three  360  ports 
were  occupied  for  a total  of  10  minutes  (on  21  separate 
occasions)  . Therefore,  in  the  month,  the  360  usage  was 
relatively  light.  The  average  time  per  login  was  just  over  16 
minutes,  although  this  varied  considerably  ever  the  time  of  day; 
with  the  fairly  low  number  of  logins  (452  in  the  month),  little 
significance  can  te  attached  tc  this  result. 

A total  of  49  idents  were  used  from  28  different  A R F A hosts, 
although  the  predominant  usage  (611)  was,  as  expected,  from  the 
London-TIP.  It  should  be  emphasised  that  the  local  usage  is  very 
seriously  underestimated  since  the  HASP  system  console  is  a 
permanently  connected  device  which  dees  not  gc  throuqh  the  TIP 
and  the  usage  of  this  device  (which  is  high)  is  not  teccr’ed  by 
the  logging  program. 

We  are  able  alsc  to  record  the  usage  of  ARPANET  from  the  360  and, 
in  the  month  in  question,  a total  connect  time  of  834  minutes  was 
recorded  (cf.  14675  minutes  in  the  ether  direction).  This  usage 
occurred  from  16  different  devices  attached  to  the  360,  seme 
directly  attached,  others  via  werkstations.  The  most  heavily 
used  hosts  were  EBN  and  1SI  (presumably  for  message  traffic)  and 
Lawrence  Berkeley  Latcratcries  which  have  a joint  high  energy 
physics  experiment  with  RL. 

Thus,  to  briefly  summarise  the  results,  the  machines  were 
available  for  a good  propor tion  of  the  time,  the  usaqe  of  the 
PEP-9  and  RL  ports  was  fairly  lew  and  the  usaqe  cf  the  360  from 
ARPANET  was  very  much  ior*.  than  the  usage  in  the  reverse 
d irection. 
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1 • g?gult§  of.  Monitoring  PSTN  Osage 


1 . 1 Introduction 

In  this  report,  we  will  report  on  data  obtained  up  to  the  end  cf 
dune  1976.  For  reasons  explained  before  (i.e.  nc  password 
validation),  lata  before  July  1975  cannot  be  considered  valid. 
Therefore,  we  have  a year's  statistics  and  it  is  results  from 
these  data  which  we  present  in  this  section.  In  brief,  the 
results  are  those  shewn  above  in  the  sample  results,  but  for  a 
year  instead  of  a single  raenth.  In  addition,  cf  course, 
variations  from  month  tc  month  ate  noted.  The  data  we  record  are 
essentially  the  time  monitored,  the  hosts  used  by  each  group  and 
the  time  connected  tc  each  host.  There  are  many  ways  in  which 
such  data  may  be  analyzed  and,  in  this  report,  we  present  these 
results  which  we  consider  cf  most  interest.  The  full  results 
(the  actual  360  output.)  are  given  in  Ref.  71.  We  break  down  the 
results  we  give  here  into  several  distinct  sections. 


I .  2.  Monitoring  Performed  and  TIP  Port  Usage 

The  monitoring  peitormed  varies  significantly  from  day  to  day 
depending  on  t h c load  on  the  PDP-9  and,  although  the  overall 
monitoring  is  of  the  order  of  501,  much  of  this  is  at  night  „ nd 
hence  of  little  interest  since  usaqe  is  extremely  low.  The 
aonitorinq  required  a dedicated  PDP-9  and  it  cculd  not  be  spared 
for  this  purpose  during  much  cf  the  working  day.  Fiq.  P shows 
t.  h®  amount  of  aonitorinq  performed  by  month  and  Fig.  9 is  the 
monitoring  over  the  period  broken  down  by  hour  of  day  (or 
weekend).  Fiq.  1C  shews  the  frequency  cf  pert  usage;  it  is  a 
histogram  where  the  value  measured  is  the  number  of  perts  in  use 
each  time  there  is  a new  login. 

The  amount  of  pert  usage,  broken  down  by  month,  is  shown  in  Fiq. 

II.  Although  the  figures  appear  very  low,  they  ate  explained  by 
the  preponderance  cf  monitoring  during  the  night.  This  is  shown 
mere  clearly  in  Fig.  12  which  breaks  down  port  usage  by  time  cf 
day.  Nevertheless,  the  maximum  pert  usage,  -just  before  lunch 
time,  is  only  about  201.  Pig.  12  is  mirrored  closely  by  Fig.  13 
which  records  the  numrer  of  logins  per  hour  - again  a very  low 
figure.  in  order  to  attempt  to  remove  the  consistent  bias 
introduced  by  aonitorinq  cniy  in  the  mornings  and  off-peak 
periods,  a full  one  week  experiment  was  cattied  cut  in  mid- 
February  1977.  The  results  of  this  one  week  have  not  yet  been 
analyzed  but  will  be  included  in  Ref.  24. 

The  monitoring  pectoried  allows  us  tc  give  an  accurate  estimate 
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of  port  usage;  partly  as  a result  of  these  measurements,  ve  have 
recently  cancelled  scire  at  th •=  dial-up  lines  *-c  *he  london-TTF. 
This  «ovo  related  partly,  however,  to  a decision  tc  have  a 
substantial  proportion  ct  PSTN  usage  passing  through  EPSS. 


1 . J £lobai_  A SP A N |X_ Usa.ge 

The  data  for  usage,  trcken  down  by  host  and  user  group  is 
available  in  the  fern  of  the  matrix  as  shown  in  App.  1.5.  The 
full  matrix  is  fat  tcc  large  to  reproduce  (4*  x 53)  and  the  data 
may  best  be  presented  in  the  form  of  a "pie  chart".  The  chart 
for  the  various  user  qrcups  is  given  in  Pig.  14.  This  shews  very 
heavy  usage  by  the  Pritish  Library  (MEDLINE  and  CANCErilINf 
Projects) , over  54*  cf  total  usage.  There  are  two  reasons  for 
this;  first,  there  was  fairly  heavy  usage  in  the  period  because 
there  had  oeen  problems  before  the  period  we  are  discussing  and 
this  v^rv  significantly  increased  usage  over  the  summer  when 
activity  from  other  grouDs  was  very  low;  secondly,  Q'JES  only 
records  usage  via  the  PSTN  which  heavily  biases  the  data  since 
considerable  usage  is  made  of  the  network  via  directly  connected 
terminals  or  leased  lines.  Moreover,  for  university  usage,  the 
major  usaq=»  is  in  the  afternccns  whereas  nearly  all  Eritish 
Library  use  is  ever  the  o^TN  in  the  mornings. 

This  bias  is  also  apparent  in  Fig.  15  which  records  the  usage  cf 
various  hosts  and,  since  most  qrcups  cnly  access  one  or  possibly 
two  hosts,  is  very  similar  to  Fig.  14.  In  fact.,  about  half  *he 
groups  used  just  ere  hest;  the  highest  number  cf  hosts  used  ty 
one  qroup  was  fifteen.  It  must  be  emphasised  that  this  is  only 
usage  via  he  PS’IN;  lccal  usage  has  a different  pattern  (see  Sec. 
3)  . 


1.4  Indiyidua±_Hcst_Usage 

in  the  above,  we  have  net  differentiated  between  various  Hosts  on 
ARPANET  and,  in  fact,  usage  varies  significantly  from  Host  fo 
Host.  Knowinq  tbe  capabilities  of  various  machines,  it  is 
possible  not  cnly  tc  correlate  this  pattern  at  usage  with  Hosts, 
but  also,  to  a considerable  extent,  with  function.  To  give  an 
example,  we  shew,  in  Pig.  16,  the  histograms  cf  usaqe  ter  Hosts 
16  (the  front  end  processor  for  ILLIAC  TV),  147  (used  tor  MEDLINE 
access)  and  R6  (used  mainly  for  messages) . The  histogram  is 
normalized  such  that  tne  areas  under  each  histogram  are  °gual. 

This  clearly  shews  different  patterns  cf  usage.  tsi  has  a very 
high  (over  60*)  usage  of  less  than  ten  minutes  with  only  a small 
percentage  over  abcut  10  minutes,  although  there  is  a noticeable 
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Figure  15:  Usage  of  Various  ARPANET  Hosts 


i s i 

( 15%  ) 


U3°  for  arounl  twc  hours  it  a time;  this  seems  attributable  tc 
t = l peon f er en c i n q and  to**3  on-line  editing.  The  shorter  periods 
»r^,  ir.  *hj  main,  due  to  reading  and  sending  nail,  the  variations 
reflecting  *he  number  cf  (r°ssaqes.  NJ.tt  sncwr  a lever  pcrcentag*- 
' n rhe  0 tc  10  minute  period.  However,  even  this  is  protally 
artificially  high  since,  due  to  the  method  of  connection  of  NLN 
to  ARPANET,  it  is  possible  to  have  an  epen  connection  tc  the 
appropriate  NP5-TIP  pert  even  though  NIM  is  unavailable.  CUES 
records  this  as  a connection,  even  though  it  dees  net  appear  sc 
tc  the  user  an  1 hence  a considerable  part  of  this  48*  should  te 
disregarded.  It  is  not  possible  tc  say  for  certain  how  much 
falls  into  this  category  since  there  is  often  a need  to  use  NI.N 
for  relatively  shert  periods,  such  as  reading  the  system  news. 
If  most  of  this  usage  is  disregarded,  the  pattern  of  usage  shows 
a maximum  around  the  1b  minute  time  which  is  the  average  time  ter 
a "FDLINE  searen.  The  lender  times  recorded  reflect  multiple 
searches  being  carried  out  in  one  session,  as  is  apparent  frem 
the  more  detailed  data  recorded  by  the  NEDLINE  program  (see  Sec. 
2)  . 

The  usage  of  TLLIAC-IV  (or,  more  specifically,  the  POP  - 1 0 X frent- 
eni  processor  for  ILLTAC)  shews  a similar  pattern  to  that  just 
describe!  for  NIM,  except  tha*  the  average  time  is  new  arcund  30 
minutes  and  it  is  cbvicus  that  this  is  a reasonable  pattern  to 
expect  for  "serious"  work  as  opposed  to  listing  and  sending 
•nessaqes.  The  figures  for  I1LIAC  IV  should  be  treated  with 
caution  since  only  eighteen  logins  were  recorded  during  the  year; 
from  liaison  with  the  users,  we  have  ascertained  that  this  was 
due  to  the  fact  that  it  was  more  often  used  at  times  wh<  ..  QUES 
was  not  running. 

Although  the  most  common  large  machine  cr,  the  network  is  the  ECF- 
10  (or  more  specifically,  the  paqed  version,  the  PDP-10X),  the 
usaqe  of  such  machines  by  rJK  greups  is  higher  than  would  te 
expected.  This  may  te  explained  simply  by  the  fact  that  racst 
^ PP-  10X  systems  are  cn  the  n«twcu  for  relatively  qeneral 
purposes  whereas  many  other  machines  (e.g.  the  Arqonne  370/195) 
are  for  specific  purposes  and,  in  many  cases,  dc  net  proviie 
server  facilities). 


1.5  Indiv  idua l_g r cujp_U sa^e 

In  the  main,  research  groups  (defined  as  th«  people  sharinq  a TIP 
password)  use  only  one  host  seriously;  other  hosts  may  be  used 
for  short  periois  for  specific  purposes  such  as  sendinq  mail 
although  these  services  are  usually  available  or.  the  primary 
host.  Of  tne  53  groups  we  mcnitcred  using  the  London-TIP,  2C 
used  a single  hest;  only  24  used  more  than  three  hosts  and  the 
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highest  n'mhct  of  hosts  used  w^s  16.  Even  in  this  last  case 
(Th.»«e.i  Polytechnic),  most  (771)  time  was  used  cn  two  hosts.  It 
must  be  emphasized  that,  at  the  present  time,  no  checking  is  done 
that  the  user  actually  connects  to  the  specified  host.  A visual 
check  of  the  dita  indicates  that  they  are  accurate;  any  errors  or 
deliberate  falsifications  are  unlikely  to  he  significant. 

Due  ta  th>  mere  or  less  cn°  to  cne  relationship  tetween  hosts  and 
user  groups,  any  data  on  greup  usaqe  should  correlate  well  with 
host  usage.  This  is  indeei  so;  however,  for  comparison,  we  show 
in  Pig.  17  usage  ty  nrofesscr  P.T.Kirstein  (ct.  Fig.  6)  whose 
major  usage  is  that  of  ISI  (Host  8b),  Professor  Hockney  (Reading 
University),  a major  user  of  ILLIAC-IV  and  BLL,  a major  user  of 
NLN.  This  matches  Piq.  If  surprisingly  well. 

Analysis  of  TIP  usage  by  u >er  group  gives  an  excellent-  check  of 
lata  provided  oy  users  of  the  TIP  (see,  tor  example.  Bet.  6) 
although  dun  to  seme  groups*  usage  b°ing  confined  to  times  -when 
DUES  is  rarely  run,  the  two  methods  should  be  seen  as 
complementary. 
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2 . 1 Introduction 

"hoso  results  may  be  broken  down  into  two  qrcups.  The  first  are 
the  results  from  the  paper  tape  log  and  the  second  arc  those 
recorded  on  the  magnetic  tape.  We  consider  these  separately. 


2.2  !i  d 

These  data  are  these  recorded  on  the  paper  tape  loq.  Use  ct  NLH 
may  be  broken  -.own  into  two  distinct  phases  over  the  year.  The 
first  is  use  of  (IfnLINF  alone  and  this  experiment  took  place  up 
to  the  end  of  197*:.  After  that,  new  centres  took  part  in  an 
experiment  to  evaluate  the  CANCTR1.INF,  database.  Since  there  were 
considerable  prctlems  over  the  first  few  months  of  197b,  due  both 

to  hardware  problems  with  the  terminals  and  software  problems  at  j 

tl L fl , little  access  was  cbtained.  Therefore,  we  confine  our 

observations  to  the  period  July  1975  to  December  1975  in  this  I 

section.  \ 

j 

As  with  the  data  reported  in  Part  II  tor  July,  there  is  1 

consilerable  variation  in  all  parameters  and  this  is  clearly  i 

shewn  in  Fiqs.  19  and  19  which  show  the  usaqp  in  terms  of  time  j 

connected  tc  MF  and  the  number  of  Lines  sent  from  NLN . As 

stated  above,  due  tc  the  mode  of  operation  of  CJU'5  and  the  NBS-  I 

NLM  interconnection,  short  connect  times  are  recorded  when,  in  ] 

fact,  no  real  connection  was  made.  Removing  such  data  (and,  I 

also,  unfortunately,  seme  data  where  a qenuine  tut  brief  J 

connection  was  mad*-),  an  average  time  per  session  of  just  under  J 

23  minutes  is  found,  indicating  that  most  users  perform  one  j 

search  per  session,  although,  in  one  session,  thirteen  searches  \ 

were  performed  (in  nearly  twe  hours) , involvinq  over  twenty 

thousand  characters  output  from  nz.fi.  j 


2.3  Transcript  Data 

In  recent  months,  the  MFD1INE  program  has  be^n  modified  so  that, 
if  required,  it  i.s  ible  to  monitor  onto  either  drum  or  magnetic 
tape.  The  data  reccrdel  is  a transcript  ot  the  user's 
ccnv »r:» at i on  with  NLA  with  the  addition  of  a timestamp.  This 
data  is  then  demultiplexed  and  analyzed. 

At  the  time  of  writirq  this  report,  only  sample  results  were 
available  trora  this  monitoring.  However,  we  have  recently 
obtained  lata  tor  an  entire  week  and  the  results  from  this 
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Figure  19:  Number  Of  Lines  Sent  From  NLM 
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acnitorin-j  will  be  presented  in  a separate  report  (Ref.  24). 
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3.  £nP-2A_Pesu>,  t £ 


3 . 1 Jnt ro juc t icn 

In  dll  the  results  described  up  tc  now,  we  have  been  considering 
use  of  US  hosts  via  ARPANET.  One  of  the  largest  computers  cn 
ARPANET  is  the  RL  36C/1S6,  accessed  through  PDP-9A.  In  a similar 
fashion  the  FHF-9E,  we  capture  the  logging  data  on  paper  tape, 
send  it  to  the  RL  machine  and  analyze  it  in  a very  similar  way. 
These  data  enable  us  to  analyze  usage  of  one  machine  from  various 
sites  (i.e.  the  inverse  of  QtJF.s  monitoring)  and  also  to  examine 
the  pattern  of  such  usaqe. 

In  addition,  we  mcnitcr  similar  usage  to  that  cf  yUES,  tut 
instead  of  monitoring  the  TIP  dial-up  ports,  we  are  monitoring 
users  on  the  360  (cr  one  of  its  remote  workstations)  accessing 
APPANFT . 

We  present  data  fcr  the  year  1976.  The  actual  analysis  output  is 
available  as  Ref.  21.  The  data  gathered  since  the  end  of  1976 
are  being  analyzed  and  the  results  will  later. 


3.2  52!lii2lil]d_Pf  I ^ _ a n d_  Pc  r t_  Usage 

In  principle,  PEP  - 9 A is  available  24  hcurs  a day  and  ill 
mcni*orini  is  performed.  In  practice,  this  time  is  reduce  < ty 
sobo  (up  to  2 hcurs  a day)  system  development.  In  addition, 
there  have  been  occasions  when  the  punch  has  run  out  cf  tape  and 
some  data  have  been  lost;  this  rarely  happens  and,  when  it  dees, 
it  is  usually  cn  Sunday  evening  during  which  time  there  is  little 
activity.  Nevertheless,  rhe  figures  quoted  are  a slight 
underestimate  due  tc  this.  The  actual  amount  of  monitoring 
performed  and  fcr  which  data  are  available  is  shown  in  Figs  20 
and  21,  the  former  tcinq  broken  down  by  month,  the  latter  by  hour 
of  day.  It  is  clear  from  the  fiqure  by  month  that  little  data 
was  available  for  January  and  not.  ail  for  Ccfoter.  In  idditicn, 
it  shows  tr.e  effect  cf  the  move  trea  Gordon  square  tc  Gower 
Street  in  July  and  the  fact  that  the  machine  was  switchei  off  fcr 
a week  over  the  Christmas  period.  The  qraph  oy  hour  of  day  shows 
a remarkable  consistency,  indicating  merely  that,  the  machine  was 
used  for  system  development  in  the  afternoon  and  early  evenings, 
thus  reducing  its  availability  in  those  periods. 

The  first  figures  we  describe  are  these  of  the  computer  up-times. 
PUP-9  A was  available  for  nearly  60*  cf  t.ho  time  but  this  figure 
is  probably  a considerable  underestimate  as  seme  dat  i arc  not 
availaole.  It  was  deliberately  shut  down  100  times  an  i crashed 
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Figure  20:  PDP-9A  Monitoring  Performed  dy  Month 
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Figure  21:  PDP-9A  Monitoring  Performed  as  a Function  of  Time  op  Day 


847  times  (although  if.  it  is  shut  .iown  incorrectly,  if  may  be 
recorded  as  a crash)  giving  an  MTPF  ot  over  six  hours.  However, 
cn  five  occasions,  a serious  fault  developed  which  caused  the 
system  to  crash  repeatedly  (since,  on  a system  crash,  there  is  an 

autorestart  mechanism).  These  five  occasions  qave  rise  to  a 

total  of  107  crashes  and  hence  a mete  realistic  figure  of  the 
number  of  crashes  wculd  be  545  giving  a true  MTHF  cf  over  0 

hours.  Obviously  all  the  other  figures  for  up  times  must  be 

lower  than  that  for  the  PDP-9  and  the  figures  we  quote  are 
absolute  with  the  relative  fiqures  in  bracKets.  The  IMP  was  by 
far  the  most  reliable  with  an  up  time  of  55*  (95*)  and  only  down 
lib  times.  PI  was  available  4R*  (83*)  and  RSPE  23*  (39*). 

Wo  also  measure  pert  usage  which  was  fairly  neavy.  It  is  net 
possible  from  the  statistics  recorded  to  determine  how  many 
attempts  to  connect  to  the  PDP-9  were  rejected  due  to  all  ports 
being  in  use.  However,  in  the  timo  considered,  all  ports  were 
occupied  155  times  fer  a total  of  174  minutes. 

In  the  case  of  the  Ft  lb1"1,  it  is  possible  to  determine  the  same 
data  (422  times  and  1185  minutes),  as  well  as  the  number  of  times 
(158)  when  a user  had  lcqged  into  the  FDP-9  and  was  then  unable 
to  log  into  the  16C  duo  tc  all  the  ports  beinq  in  use.  This  is 
net  a particularly  valuable  datum  sinc<=  a user  may  attempt  to  leg 
in  a number  of  times  in  a brief  time  interval.  Nevertheless,  it 
is  siqnificanf  that  sc  many  attempts  wer®  made  and  this  ,s  borne 
out  by  comments  from  users  as  to  their  inability  to  access  SI  at 
various  times  ot  day,  particularly  in  late  afternoon  London  time. 

This  is  shown  clearly  in  Figs.  22  and  23,  the  termer  relating  tc 
the  PD  P-9,  th*=  latter  tc  R L . The  number  cf  logins  per  hour 
fellows  a similar  pattern  and  is  omitted  from  these  graph-  fr 
clarity.  Tt  can  be  seen  that  the  pert  usage  cf  the  two  macnir.c 
is,  as  expectel,  virtually  identical.  The  peak  period  is  around 
1500  to  1600  lccal  (PST  or  GMI  as  applicable)  when  h«avy  usage 
from  local  users  coincides  with  early  morning  usage  from  the  West 
Coast  of  the  USA  and  midday  usage  from  the  East  Coast. 


3.3  Connect  iori_S  tat  istics 

l’erhaps  the  most  significant  item  in  these  results  is  the  large 
number  of  360  IDs  used  (96)  and  the  pattern  of  usage  which 
ditfet.j  not.iceihly  frem  that  recorded  by  yfl'iS  described  above. 
In  particular,  the  average  times  ate  much  higher  (an  overall 
average  of  ?7  minutes),  on  examining  the  statistics  grouped  by 
ident,  it  is  noticeable  that.  usage  by  the  IfiDRA  group  ha^  a 
larger  average  connect  time  *han  ether  jrcups.  ’.  n these 
statistics,  we  have  not  differentiated  between  local  use  and 
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remote  use  (which  could  be  dene  ty  examining  the  TIP  pert  number) 
but  it  is  certain  that  the  great  majority  of  TNDRA  qroup  usa.je  is 
via  hard-wired  terminals  and  this  may  well  influence  usage 
habits. 

As  would  be  expected,  such  usage  is  the  highest  made  of  the  PI 
’60  and  this  is  shewn  diaqrammat ically  in  Fiq.  24.  As  would  be 
expected,  this  usaqe  is  mirrored  by  the  pattern  of  hosts  used  to 
access  RL  with  the  preponderance  of  time  used  (nearly  three- 
quarters)  being  from  the  Lcndon-TTP  as  shown  in  Fiq.  25. 

We  are  also  able  to  examine  usaqe  from  terminals  attached  to  the 
RL  160  and  these  show  a considerably  different  pattern  tc  those 
just  described.  In  the  period  concerned,  users  from  twelve 
terminals  accessed  ARPANET  (cne  of  which  was  the  PDP-d  system 
console)  but  the  averaqe  connect  time  uas  only  fifteen  minutes. 
On  examining  the  fiqures  more  closely,  it  is  clear  that  most  cf 
♦he  usaqe  was  trivial  but  there  was  seme  serious  use  made  of  the 
Lawrence  Herkeley  Laboratories  which  ace  involved  with  PI  on 
collaboration  in  high  energy  physics.  This  accounted  for  nearly 
001  of  the  time  used  in  the  year  beinq  considered,  although  it 
snould  be  pointed  cut  that  the  time  used  in  this  direction  (8611 
user  minutes)  is  very  much  smaller  than  the  time  used  by  ARPA 
users  accessing  RL  (144,65c  user  minutes)  and  hence  the  figures 
should  be  treated  with  some  caution,  although  the  patter’’  cf 
serious  work  involving  relatively  long  terminal  sessions  (an.,  of 
course,  the  session  would  probably  include  usage  of  RL  systems 
either  before  or  after  the  interaction  with  the  remote  host)  with 
a number  of  users  attempting  to  connect  to  u host  tor  very  short 
periods,  presumably  tc  investigate  the  mode  cf  access. 


i.u  Gr oup_u§ag e 

Although  the  only  information  about  the  user  available  from  the 
PDP-RA  log  is  his  ident  (and  initials  which  are  in  no  way 
checkei)  , this  information  is  sufficient  tc  enable  us  to 
determine  group  usage  since  each  group  uses  a specific  set  cf 
idents.  Ln  particular,  in  this  section,  we  investigate  usage  of 
the  RL  160/1R5  by  three  groups.  The  first  is  the  TNDPA  group  at 
iJCL  {llt.nouqh,  as  explained  above,  such  data  omits  usage  from  the 
HASP  system  console  which  is  not  Loqqed  - from  PL  statistics, 
this  usage  is  almost  exactly  a quarter  of  that  us*’ 1 by  the  ports 
available  to  APTA  users) . The  second  group  is  concerned  with 
seismic  data  coliaticn  and  analysis  and  the  third  is  involved 
witn  high  energy  physics  experiments.  The  usage  of  *h«5  ty 
these  three  qroups  ever  the  months  cf  the  year  is  shown  in  Fig. 
26. 
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Figure  24:  Usage  of  RL  360/195  by  Various  Research  Projects 
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Figure  25:  Usage  of  RL  360/195  from  Various  ARPANET  Hosts 
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The  oriimte  chews  ^he  percentage  of  total  use  of  the  PDF-'}  fcr 
the  specifier!  mcnth.  It  is  cleat  that  the  H1?  groups  used  only  a 
relatively  low  proportion  ct  the  time,  rising  from  nothing  at  the 
beginning  of  the  y»ar  to  a peak  in  June,  tailing  off  towards  the 
autumn  then  startinq  to  increase  again  at  the  end  of  the  year. 
The  seismic  group  usaqe  is  distorted  to  the  extent  that  the  two 
peaks  correspond  to  relatively  lew  usaqe  by  the  IhDRA  group  and 
thus  the  percentage  use  is  artificially  increased.  Nevertheless, 
t.  he  pattern  shown  is  correct.  The  usaqe  by  the  I NDF  A group  is  as 
would  be  expected.  The  lower  usage  in  the  early  summer 
corresponds  to  the  equipment  meve  mentioned  previously.  The 
rapid  increase  after  July  corresponds  not  only  tc  compensation 
tor  lack  of  machine  time  tut  alsc  the  use  of  the  RI  machine  ty 
H.Sc.  students  for  their  pro-jects  over  the  summer  months. 
Towards  the  end  of  the  year,  a more  consistent  pattern  emerged. 


3. 6 Filo_ Transfers 

We  measure  file  transfers  both  from  ARPANET  to  and  from  local 
machines  (nearly  always  the  »L  36  C)  and  from  RL  to  the  FCF-R 
(which  are  nearly  all  Babbage  source  code  being  cross- Assembled 
to  pnp-g  Assembler  (Ref.  17)).  in  Fig.  27  we  show  the  number  of 
file  transfers  performed  ct  toth  types,  normalized  with  respect 
to  the  time  monitored.  Specif ical ly,  the  scale  is  the  number  cf 
events  per  1CC0  minutes  monitored. 

Fcr  comparison,  we  also  show  the  number  of  logins  per  month, 
suitably  normalized.  The  figures  show  nc  correlation  wits  each 
other,  althouqh  the  figures  for  tiles  from  the  360  show,  as 
expectel,  a high  deqree  of  correlation  with  the  general 
activities  of  the  TNCRA  group.  Lockinq  at  the  file  transfers  in 
more  detail,  it  becomes  clear  that  there  is  correlation  tetween 
the  number  of  file  transfers  and  the  activities  of  various 
groups.  Fiq.  28  shows,  again  broken  down  by  month,  the  number  cf 
file  transfers  by  qrcup  and  this  correlates  well  witn  Fig.  26. 

Similarly,  we  show,  ir  Fiq.  23 , the  usaqe  of  the  file  transfer 
from  various  hosts  on  the  network.  Again  the  correlation  with 
group  usage  is  evident. 

Finally,  in  Fig.  30,  wc  show  the  breakdown  by  time  ot  day  (local 
time  - 3ST  or  ONI).  This  is  very  similar  to  that  shewn  fcr 
terminal  access  (sea  Fiq.  12)  and  similar  comments  apply. 
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Figure  27:  File  Transfers  by  Hdnth 
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Figure  29:  Usage  of  ARPANET  Hosts  for  File  Transfers 
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1.  2pP-2_2f£GBAHS 
1 . 1 2UES/3EDiiNE 


This  is  the  standard  system  tc  run  on  PDP-9(B).  To  tun  it 
that  is  necessary  is  tc  bootstrap  the  system  frca  tape 
Various  ACC  switches  «ay  bo  set  with  the  following  effects: 


all 

151. 


1 

1 

ft 

7 


Auto  restart  in  the  event  of  a system  crash 
Tc  not  monitor  MEDLINE  program 
Monitor  to  drum  rather  than  tape 
Trace  system  variables 


A tape 
unless 


■ust  be  available  on  the  tape  drive 
either  switch  3 cr  switch  6 is  set. 


with  write  enabled. 
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2.  5L_ 360^J95_ ffCGRAMS 


2 . 1 XFSTATS 

> A user  guide  to  the  XFSTATS  package,  including  some  details  of 

the  proqrams  described  in  detail  above  is  available  as  Ref.  20, 
as  is  a description  cf  the  procedure,  also  called  XFSTATS. 

XFSTATS  is  a member  of  the  ELECTRIC  public  library  JOEFILE  and  is 
accessed  by: 

EXEC  JB=  X FST  ATS, 

where  all  the  ether  parameters  are,  due  to  the  method  cf 
operation  of  ELECTRIC  (Ref.  3),  keyword  parameters.  The  allowed 
keywords,  their  defaults  and  meanings  are  shewn  below: 


Name 

Default 

Heanin ) 

PHI 

12 

Priority 

ACCT 

Locqed  in  A/C 

Account 

in 

Loqced  in  ID 

Identifier 

LINES 

Lines  of  output 

T IrtE 

CPU  time  required 

COPIES 

1 

Copies  of  output 

LPARN 

NONAP, NOLIST 

Link-edit  parameters 

V 

- 

Version  cf  program  (null 

PRO* 

V7/75 

Start  date 

TO 

1/7/76 

Finish  date 

OP 

Operation 

OP2 

- - 

M 

OP  3 

-- 

II 

OP4 

-- 

M 

OPS 

-- 

II 

CONTROL 

File  of  control  cards 

dump 

Li nepr  intrar 

Dump  stream 

The  global  edit  (EL)  is  provided  to  enable  the  output  to  be 
written  back  into  Electric.  If  this  is  used,  the  following 


1 

0 

plants 

ar->  allowed: 

* 

SPP 

t ; 

Primary  space  (tracks) 

SPS 

lJ 

Secondary  space 

(tracks) 
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nicroficho,  as  well  as  for  the  use  of  the  RL  graphical  routines 
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The  method  of  mcnitctinq  and  access  control  (CUES)  we  have 
developed  is  not  cf  qeneral  application,  particularly  since  it 
requires  a dedicated  processor  in  addition  to  the  one  being 
mcnit.ored  and,  in  the  qeneral  case,  it  is  obviously  siapler  to 
put  these  functions  in  the  latter.  However,  the  introduction  of 
monitoring  and/or  access  controls  into  a computer  brinqs  with  it 
a loss  of  reliability  (since,  net  only  does  it  increase  the 
complexity  of  the  software  tut  also  it  requires  additional 
hardware).  This  less  of  reliability  may  not  be  acceptable  and  so 
our  technique  may  be  cf  more  qeneral  applicat il ity . 

An  example  of  this  is  evinced  by  ARPANET.  Access  controls  were 
introduced  into  the  TIPs  in  late  1974  and,  for  a number  of 
reasons  (in  particular,  the  decrease  of  reliability  that  backinq 
stor°  would  introduce  and  the  problems  cf  maintaininq  the 
password  data  base)  it  was  introduced  in  a way  that  lei  to 
inconvenience  for  users  and  larqe  network  overheads.  Althouqh 
our  approach  would  no*  obviate  the  problem  of  maintaininq  the 
data  base,  it  would  certainly  net  decrease  the  reliability  ot  the 
TIPs.  At  the  present  time,  the  LONDCN-TIP  is  the  only  node  on 
ARPANET  on  which  monitcrinq  of  users  and  access  control  is  being 
carried  out. 

Tne  technique  of  recording  the  data  ento  paper  tape  nas  certain 
advantages,  in  particular  the  tact  that  a system  crash  cannot 
corrupt  the  data.  However,  it  has  many  attendant,  disadvantages 
and  a more  mechanical  method  of  sending  the  recorded  data  to  the 
machine  on  which  it  is  to  be  analyzed  would  be  ot  considerable 
value.  This  may  be  dene  with  reasonably  little  effort  on  PCP-9A 
but,  since  PDP-9E  is  not  connected  to  the  RL  machine,  it  would 
prove  more  difficult  in  that  case.  Various  problems  in  the 
analysis  have  been  feund  and  this  experience  will  enable  us  to 
overcome  such  problems  in  future.  For  example,  a major  proHem 
with  analyzinq  the  PCP-9A  data  has  been  the  fact  that  users 
frequently  give  the  machine  the  wrong  date  and/or  time  and  this 
means  that  the  data  has  tc  be  edited  manually.  It  would  be 
fairly  simple  to  check  the  time  with  that  on  a connected  irichire 
and,  perhaps,  to  flag  an  errer  if  a discrepancy  were  noted. 
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2.  Nj-TWORS-SSAGE 


Using  the  techniques  we  have  described,  we  have  been  able  to 
obtain  a fairly  accutate  picture  of  the  extent  of  usaqe  of  the 
network  for  different  a ppl ica t icns . The  measurements  give  an 
excellent  cross-check  on  subjective  reports  from  user  groups  cn 
their  usaqe  of  specific  Hcsts  (Ref.  7). 

The  monitoring  performed  cn  PDP-9A  is  of  similar  interest,  giving 
us  a picture  both  of  the  usage  of  one  large  machine  on  ARPANET 
and  of  the  usaqe  of  ARPANET  through  such  a machine.  Huch  of  the 
data  obtained  correlates  that  expected  or  experienced 
qualitatively  but  nevertheless,  a quantitative  evaluation  is 
valuable.  A very  large  volume  of  data  has  been  collected  and 
analyzed  and  the  results  are  presented  in  detail  in  this  report. 
However,  a number  of  conclusions  about  network  usage  stand  cut. 
These  are,  in  nc  particular  crder: 

(i)  Sessions  from  hardwired  terminals  are  longer  than  those 
through  th=>  ESTN 

(ii)  The  most  frequently  used  computer  system  on  the  network 
is  the  Tenex  (even  more  than  wculd  be  expected  from  the 
predominance  cf  such  machines) 

(iii)  Par  greater  use  is  made  of  the  RL  360  from  ARPANET  than 
the  converse. 
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1.  OVER ALL_CCNCLnSIONS 


We  have  developed  a nuaber  cf  powerful  access  control  and 
aonitorinq  techniques,  includinq  both  data  acquisition  and 
analysis.  These  aethcds  have  proved  of  qreat  value  and 
coapleaent  ether  aonitorinq  perforaed  on  ARPANET. 

nse  of  these  tocls  has  enabled  us  to  obtain  a fairly  complete 
picture  of  the  usaqe  of  the  UC  nede  of  ARPANET  both  via  the 
PSTN  and  directly.  We  have  teen  aDle  to  verify  users 
subjective  reports  and  perfora  quantitative  aeasureaents  on 
aany  aspects  cf  usaqe. 

Thus  our  techniques  have  preved  cf  considerable  use  in  the 
past  and  can  ccntinue  tc  do  sc  in  future. 
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APPENDIX_Ij. SAHPiJ_C*TA 

These  data  are  intended  tc  show  the  input  and  output  of  the 
various  analysis  programs.  In  order  to  fit  into  the  page 
format,  soue  slight  editing  has  teen  done. 
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Tn  order  to  save  space,  fclank  lines  and  proapt  lines  have 
been  removed  trca  this  Appendix. 
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I1  DSC  76  20  3 1 ***:  PDP-9  OP 

13  DEC  76  20  31  R RE  :CCR  AL  EACK 

13  DEC  76  20  31  IBCiINT  RESFT 

13  DEC  76  20  3 1 D«1:CCNTACT  WITH  3bO  MADE  A 7 20  31 

13  DEC  76  20  32  RRFiRRE  ERROR  " OR 

13  DEC  76  20  37  ICPiICP  HCS  170  PT  06  CH  A 

13  DEC  76  20  37  TELiCHL  A ZZF  LOG  F3  01 

13  OEC  76  20  61  ICPiICP  HCS  12  PT  00  CH  R 

13  DEC  76  20  62  TELiCHL  R XX  LOG  1R  02 

13  DSC  76  20  45  TELiCHL  3 LOG  OUT  4 CL5 

13  DEC  76  20  47  TELiCHL  A LOG  OCT  4 CLS 

13  DSC  76  21  10  ICPiICP  HCS  70  PT  00  CH  A 

13  DEC  7 o 21  10  TELiCHL  A CLS 

13  OEC  76  21  21  ICFiICP  HCS  176  PT  03  CH  A 

13  DEC  76  21  21  T EL: CHL  A HJW 

13  DEC  76  21  23  TEL :CHL  A CLS 

13  DEC  76  21  47  ICPiICP  HOS  76  PT  00  CH  A 

13  DEC  76  21  4fl  TEIrCHL  A GA  LOG  7T  01 

13  DEC  76  21  49  T EL : C KL  A LCG  OLT  4 CLS 

13  DEC  76  21  57  ICPiICP  HCS  55  PT  15  CH  A 

13  DEC  76  22  0 1 T EL : CHL  A HSH  ICG  BJ  01 

13  DEC  76  2?  04  ICPiICP  HCS  176  PT  03  CH  B 

13  DEC  76  22  04  TElrCFL  A LOG  OLT  4 CLS 

13  DEC  76  22  29  ICPiICP  HCS  09  PT  03  CH  B 

13  DEC  76  22  ?9  TELiCHL  P RW  LCG  RJ  01 

1’  DEC  76  2?  34  TELiCHL  q LCG  OUT  4 CLS 

1 1 DEC  76  22  47  ICPiICP  HCS  76  PT  00  CH  P 

13  DSC  76  22  46  TEllCHL  R GA  IOG  ZT  01 

13  DEC  76  22  53  ICPiICP  HOS  241  PT  30  CH  C 

13  DEC  76  22  54  TELiCHL  c LOG  COT  4 CLS 

13  DEC  76  22  54  ICPlFTP  HCS  76  PT  00  CH  P 

13  DEC  76  22  55  FIP:  USEP  ZT  GETTING  FILS  INDRA. IN561 

13  DEC  76  22  55  DNC:$*.70R  518  ON  RH3.RD2  --  XPTF  A R F A 

13  DEC  76  23  09  TETiCHL  D CLS 

13  DEC  76  23  09  TELiCHL  H CLS 

13  DSC  76  23  21  TELiCHL  A CLS 

14  DEC  76  00  79  ICPiICP  HCS  70  PT  CO  CH  A 

14  DEC  76  00.19  IELiCHI.  A CLS 

14  DEC  76  00  56  CRIlCCNTACT  WITH  360  LCST  AT  00  56 

14  DEC  76  01  17  ICFiICP  HCS  70  PT  00  CH  A 

14  DEC  76  01  17  TELiCHL  A CLS 

14  DEC  76  01  41  D R 1 : CCNT  ACT  WITH  360  HADE  AT  Cl  <4 1 

14  DEC  76  01  56  ***:  FDP-9  CRASHED 
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